CVE-2026-90110: inetpeer: randomize RB-tree node comparison using SipHash
In the Linux kernel, the following vulnerability has been resolved:
inetpeer: randomize RB-tree node comparison using SipHash
The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard lexicographical comparisons (inetpeeraddrcmp), an off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gcstack candidate list).
By combining deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds inetpeerthreshold), an attacker can selectively force the eviction of targeted inetpeer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket (ratetokens, ratelast) is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style attacks).
Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key (inetpeerhashkey) initialized via netgetrandomonce(). Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction gadget.
Cache the computed 64-bit SipHash (hash) in struct inetpeer and compute the target hash (dhash) once at the beginning of inetgetpeer() to avoid recomputing SipHash at every step of the RB-tree walk.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Randomize inetpeer RB-tree node comparison using SipHash with the secret key inetpeer_hash_key initialized via net_get_random_once(); order nodes by SipHash(addr, key) instead of raw IP addresses, cache the computed 64-bit SipHash in struct inet_peer, and compute the target hash (dhash) once at the beginning of inet_getpeer().
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be performed by an off-path adversary. It relies on predicting deterministic inetpeer Red-Black tree traversal and triggering aggressive garbage collection after the tree exceeds inet_peer_threshold.
What security controls can be bypassed or affected?
Evicting and then recreating a targeted inet_peer entry resets its rate-limiting token bucket to full capacity. This can bypass IP-keyed ICMP rate limits and provide a side channel for inferring open UDP ports.
What mitigation is described?
The resolved change randomizes inetpeer RB-tree node comparison with SipHash. It uses a secret inetpeer_hash_key initialized through net_get_random_once(), preventing predictable tree topology and traversal.